Cryptographic devices include, by way of example, one-time passcode (OTP) devices such as authentication tokens. Authentication tokens are typically implemented as small, hand-held devices that display a series of passcodes over time. A user equipped with such an authentication token reads the currently displayed passcode and enters it into a computer or other element of an authentication system as part of an authentication operation. This type of dynamic passcode arrangement offers a significant security improvement over authentication based on a static password.
Conventional authentication tokens include both time-synchronous and event-synchronous tokens.
In a typical time-synchronous token, the displayed passcodes are based on a secret value and the time of day. A verifier with access to the secret value and a time of day clock can verify that a given presented passcode is valid.
One particular example of a time-synchronous authentication token is the RSA SecurID® user authentication token, commercially available from RSA, The Security Division of EMC Corporation, of Bedford, Mass., U.S.A.
Event-synchronous tokens generate passcodes in response to a designated event, such as a user pressing a button on the token. Each time the button is pressed, a new passcode is generated based on a secret value and an event counter. A verifier with access to the secret value and the current event count can verify that a given presented passcode is valid.
Other known types of authentication tokens include hybrid time-synchronous and event-synchronous tokens.
Passcodes can be communicated directly from the authentication token to a computer or other element of an authentication system, instead of being displayed to the user. For example, a wired connection such as a universal serial bus (USB) interface may be used for this purpose. Wireless authentication tokens are also known. In authentication tokens of this type, the passcodes are wirelessly communicated to a computer or other element of an authentication system. These wired or wireless arrangements, also referred to herein as connected tokens, save the user the trouble of reading the passcode from the display and manually entering it into the computer.
The above arrangements may be viewed as examples of what are more generally referred to herein as hardware authentication tokens. However, authentication tokens can also be implemented in the form of software installed on a computer, mobile phone or other processing device. Like hardware authentication tokens, software authentication tokens can be implemented as time-synchronous, event-synchronous, or hybrid time-synchronous and event-synchronous tokens.
Hardware and software authentication tokens and other types of OTP devices are typically programmed with a random seed or other type of key that is also stored in a token record file. The record file is loaded into an authentication server, such that the server can create matching passcodes for the authentication token based on the key and the current time or current event count.
In order to protect authentication tokens against cloning attacks, the keys used by these tokens may be periodically refreshed using approaches such as drifting keys, in which a set of secret keys shared between an authentication token and an authentication server evolve randomly over time. Periodic refresh operations are applied to the set of keys, typically at the start of respective time periods. Such time periods are examples of what more generally referred to herein as “epochs.”
Certain authentication tokens or other types of cryptographic devices are configured to store a number of precomputed passcodes rather than to compute all passcodes on an as-needed basis (i.e., “on the fly”). Such an arrangement is particularly well suited for use in devices that have limited computational power but significant memory resources. Authentication tokens of this type are also referred to as stored-passcode authentication tokens and can be implemented using reduced computational resources relative to tokens that generate passcodes on the fly. However, a drawback of conventional stored-passcode authentication tokens is that such tokens are generally unable to support communication via side channels or other types of auxiliary channels. Such auxiliary channels are useful in supporting the above-noted drifting keys approach as well as other related security functions such as silent alarms.